]> Git — Sourcephile - sourcephile-nix.git/blob - servers/mermet/dovecot.nix
openldap: see if something can be upstreamed
[sourcephile-nix.git] / servers / mermet / dovecot.nix
1 { pkgs, lib, config, system, ... }:
2 let
3 inherit (builtins) toString toFile readFile;
4 inherit (builtins.extraBuiltins) pass;
5 inherit (lib) types;
6 inherit (pkgs.lib) loadFile unlines unlinesAttrs unlinesValues unwords;
7 inherit (config) networking;
8 inherit (config.services) dovecot2 postfix openldap;
9
10 # NOTE: nixpkgs' dovecot2.stateDir is currently not exported
11 stateDir = "/var/lib/dovecot";
12
13 sieve_pipe_bin_dir = pkgs.buildEnv {
14 name = "sieve_pipe_bin_dir";
15 pathsToLink = [ "/bin" ];
16 paths = [
17 learn-spam
18 learn-ham
19 ];
20 };
21 learn-spam = pkgs.writeShellScriptBin "learn-spam.sh" ''
22 exec ${pkgs.rspamd}/bin/rspamc -h /run/rspamd/learner.sock learn_spam
23 '';
24 learn-ham = pkgs.writeShellScriptBin "learn-ham.sh" ''
25 exec ${pkgs.rspamd}/bin/rspamc -h /run/rspamd/learner.sock learn_ham
26 '';
27
28 dovecot-virtual = pkgs.buildEnv {
29 name = "dovecot-virtual";
30 pathsToLink = [ "/" ];
31 paths = [
32 dovecot-virtual-all
33 dovecot-virtual-recents
34 ];
35 };
36 dovecot-virtual-all = pkgs.writeTextFile {
37 name = "dovecot-virtual-all";
38 destination = "/All/dovecot-virtual";
39 text = ''
40 *
41 all
42 '';
43 };
44 dovecot-virtual-recents = pkgs.writeTextFile {
45 name = "dovecot-virtual-recents";
46 destination = "/Recents/dovecot-virtual";
47 text = ''
48 *
49 all younger 172800
50 '';
51 };
52 dovecot-virtual-pop3 = pkgs.writeTextFile {
53 name = "dovecot-virtual-pop3";
54 destination = "/pop3/INBOX/dovecot-virtual";
55 text = ''
56 All
57 All+*
58 all
59 '';
60 };
61 in
62 {
63 imports = [
64 dovecot/autoconfig.nix
65 ];
66 systemd.services.dovecot2 = {
67 after = [
68 "postfix.service"
69 "openldap.service"
70 "${networking.domain}.key.pem-key.service"
71 ];
72 };
73 #users.users."${dovecot2.mailUser}".isSystemUser = true; # Fix nixpkgs
74 services.dovecot2 = {
75 enable = true;
76 modules = [
77 pkgs.dovecot_pigeonhole
78 pkgs.dovecot_fts_xapian
79 ];
80 enablePAM = false;
81 enableImap = true;
82 enableLmtp = true;
83 enablePop3 = true;
84 protocols = [ "sieve" ];
85 # If needed, may be overrided by userdb_mail= in passdb, or mail= in userdb
86 # Here INDEX and CONTROL are separated,
87 # it's not useful since there is not quota at the filesystem level
88 # it's just to let this possibility later on.
89 mailLocation = "sdbox:${stateDir}/mail/%d/%n/mail.d:UTF-8:CONTROL=${stateDir}/control/%d/%n:INDEX=${stateDir}/index/%d/%n";
90 createMailUser = false;
91 mailUser = "";
92 mailGroup = "";
93 sslServerCert = null;
94 sieveScripts = {
95 global = dovecot/sieve/global;
96 };
97 extraConfig = ''
98 auth_verbose = yes
99 auth_debug = yes
100 mail_debug = yes
101 verbose_ssl = no
102 log_timestamp = "%Y-%m-%d %H:%M:%S "
103
104 ssl = required
105 ssl_dh = <${../../../sec/openssl/dh.pem}
106 ssl_cipher_list = HIGH:!LOW:!SSLv2:!EXP:!aNULL
107 ssl_cert = <${loadFile (../../../sec + "/openssl/${networking.domain}/cert.self-signed.pem")}
108 ssl_key = </run/keys/${networking.domain}.key.pem
109 #ssl_ca = <''${caPath}
110 #ssl_verify_client_cert = yes
111
112 listen = *
113 # If needed, may be overrided by userdb_mail
114 mail_home = ${stateDir}/mail/%d/%n
115 # Read multiple mails in parallel, improves performance
116 mail_prefetch_count = 20
117 # Default VSZ (virtual memory size) limit for service processes. This is mainly
118 # intended to catch and kill processes that leak memory before they eat up everything.
119 # Increased for fts_xapian.
120 default_vsz_limit = 1G
121
122 # DOC: https://doc.dovecot.org/configuration_manual/authentication/authentication_mechanisms/
123 # DOC: https://ldapwiki.com/wiki/DIGEST-MD5
124 # The misunderstanding is the notion "password sent over the network in plain-text" is not secure,
125 # when in fact, storing the password in the directory server using a Salted SHA-2 hash
126 # and transmitting the clear text password over a secure connection
127 # is more secure than having the directory server store the password in clear text
128 # or in a reversible encryption scheme.
129 # Therefore, SASL with DIGEST-MD5 (or CRAM-MD5) should be avoided.
130 # Use doveadm pw -s SSHA
131 # or doveadm pw -s PBKDF2 -r 10000
132 # or slappasswd -o module-load=pw-pbkdf2 -h "{PBKDF2-SHA256}"
133 auth_mechanisms = plain login
134 auth_username_format = %Ln
135 passdb {
136 driver = ldap
137 # Because auth_bind=yes and auth_bind_userdn are used,
138 # this cannot prefetch any userdb_*.
139 args = ${dovecot/ldap/sourcephile.fr.conf}
140 default_fields =
141 override_fields =
142 }
143 userdb {
144 driver = ldap
145 # A different path than passdb's args enables non-blocking LDAP requests
146 args = ${pkgs.symlinkJoin {name="ldap"; paths=[dovecot/ldap];}}/sourcephile.fr.conf
147 default_fields =
148 override_fields =
149 }
150 service auth {
151 user = ${dovecot2.user}
152 # auth_socket_path points to this userdb socket by default. It's typically
153 # used by dovecot-lda, doveadm, possibly imap process, etc.
154 # Users that have access to this socket are able to get a list
155 # of all usernames and get results of everyone's userdb lookups.
156 unix_listener auth-userdb {
157 user = ${dovecot2.user}
158 group = ${dovecot2.group}
159 mode = 0660
160 }
161 unix_listener /var/lib/postfix/queue/private/auth {
162 user = ${postfix.user}
163 group = ${postfix.group}
164 mode = 0660
165 }
166 }
167 service auth-worker {
168 user = ${dovecot2.user}
169 }
170 auth_cache_verify_password_with_worker = yes
171 # SEE: http://wiki2.dovecot.org/Quota/FS
172 # NOTE: postfix does not supply a client cert.
173 auth_ssl_require_client_cert = no
174 #auth_ssl_username_from_cert = yes
175 # NOTE: lowercase the username, help with LDAP?
176 auth_username_format = %Lu
177 # NOTE: sync with LDAP's data.
178 first_valid_uid = 1000
179 disable_plaintext_auth = yes
180
181 # No dirty syncs for maildir: locations which may be used directly by neomutt
182 maildir_very_dirty_syncs = no
183 namespace Inbox {
184 type = private
185 inbox = yes
186 hidden = no
187 list = yes
188 prefix =
189 separator = +
190 }
191 namespace Shared {
192 type = shared
193 #list = children
194 # NOTE: always listed in the LIST command.
195 list = yes
196 # NOTE: how to access the other users' mailboxes.
197 # NOTE: %var expands to the logged in user's variable, while
198 # %%var expands to the other users' variables.
199 # NOTE: INDEX and CONTROL are shared, INDEXPVT is not.
200 location = sdbox:${stateDir}/mail/%%d/%%n/${stateDir}/mail.d:UTF-8:CONTROL=${stateDir}/control/%%d/%%n/Shared:INDEX=${stateDir}/index/%%d/%%n/Shared:INDEXPVT=${stateDir}/index/%d/%n/Shared/%%n
201 prefix = Partages+%%n+
202 separator = +
203 subscriptions = yes
204 }
205 mail_plugins = $mail_plugins virtual
206 namespace Virtual {
207 prefix = Virtual+
208 separator = +
209 hidden = no
210 list = yes
211 subscriptions = no
212 location = virtual:${dovecot-virtual}:UTF-8:INDEX=${stateDir}/index/%d/%n/virtual
213 }
214
215 mail_plugins = $mail_plugins acl
216 plugin {
217 acl = vfile:/etc/dovecot/acl/global.d
218 acl_anyone = allow
219 # NOTE: to let users LIST mailboxes shared by other users,
220 # Dovecot needs a shared mailbox dictionary.
221 # FIXME: %d not working with userdb ldap
222 acl_shared_dict = file:${stateDir}/acl/%d/acl.db
223 }
224
225 mail_plugins = $mail_plugins fts fts_xapian
226 plugin {
227 plugin = fts fts_xapian
228 fts = xapian
229 fts_autoindex = yes
230 fts_autoindex_exclude = \Junk
231 fts_autoindex_exclude2 = \Trash
232 fts_enforced = yes
233 # 2 and 20 are the NGram values for header fields, which means the
234 # keywords created for fields (To, Cc, ...) are between is 2 and 20 chars long.
235 # Full words are also added by default.
236 fts_xapian = partial=2 full=20 verbose=0
237 }
238
239 mail_plugins = $mail_plugins quota
240 plugin {
241 quota = maildir:User quota
242 quota_rule = *:storage=256M
243 quota_rule2 = Trash:storage=+64M
244 quota_max_mail_size = 20M
245 #quota_exceeded_message = </path/to/quota_exceeded_message.txt
246 quota_warning = storage=95%% quota-warning 95 %u
247 quota_warning2 = storage=80%% quota-warning 80 %u
248 quota_warning3 = -storage=100%% quota-warning below %u
249 }
250
251 protocol lda {
252 hostname = ${networking.domain}
253 mail_plugins = $mail_plugins sieve
254 postmaster_address = postmaster+dovecot+lda@${networking.domain}
255 syslog_facility = mail
256 }
257 lda_mailbox_autocreate = yes
258 lda_mailbox_autosubscribe = yes
259
260 protocol lmtp {
261 mail_plugins = $mail_plugins sieve
262 postmaster_address = postmaster+dovecot+lmtp@${networking.domain}
263 }
264 service lmtp {
265 process_min_avail = ${toString config.nix.maxJobs}
266 unix_listener /var/lib/postfix/queue/private/dovecot-lmtp {
267 user = ${postfix.user}
268 group = ${postfix.group}
269 mode = 0600
270 }
271 }
272 plugin {
273 # Let extension.sieve do the handling of the detail
274 #lmtp_save_to_detail_mailbox = yes
275 recipient_delimiter = ${postfix.recipientDelimiter}
276 }
277
278 service imap {
279 # Most of the memory goes to mmap()ing files.
280 # You may need to increase this limit if you have huge mailboxes.
281 #vsz_limit =
282 process_limit = 1024
283 }
284 service imap-login {
285 #inet_listener imap {
286 # address = 127.0.0.1
287 # port = 143
288 # ssl = no
289 #}
290 inet_listener imaps {
291 port = 993
292 ssl = yes
293 }
294 }
295 # Store METADATA information within user's HOME directory
296 mail_attribute_dict = file:%h/dovecot-attributes
297 # If you have Dovecot v2.2.8+ you may get a significant performance improvement with fetch-headers:
298 imapc_features = $imapc_features fetch-headers
299 protocol imap {
300 #mail_max_userip_connections = 10
301 mail_plugins = $mail_plugins imap_acl imap_quota imap_sieve virtual
302 imap_metadata = yes
303
304 # DOC: https://wiki.dovecot.org/MailboxSettings
305 # Due to a bug in Dovecot v2.2.30+ if special-use flags are used,
306 # SPECIAL-USE needs to be added to post-login CAPABILITY response as RFC 6154 mandates.
307 imap_capability = +SPECIAL-USE
308
309 namespace Inbox {
310 mailbox "Archives" {
311 auto = subscribe
312 special_use = \Archive
313 }
314 mailbox "Drafts" {
315 auto = no
316 special_use = \Drafts
317 }
318 mailbox "Brouillons" {
319 auto = subscribe
320 special_use = \Drafts
321 }
322 mailbox "Junk" {
323 auto = no
324 #autoexpunge = 30d
325 special_use = \Junk
326 }
327 mailbox "Spams" {
328 auto = no
329 special_use = \Junk
330 }
331 mailbox "Spam" {
332 auto = no
333 special_use = \Junk
334 }
335 mailbox "Pourriels" {
336 auto = no
337 special_use = \Junk
338 }
339 mailbox "Pourriel" {
340 auto = no
341 special_use = \Junk
342 }
343 mailbox "Sent" {
344 auto = no
345 special_use = \Sent
346 }
347 mailbox "Sent Items" {
348 auto = no
349 special_use = \Sent
350 }
351 mailbox "Sent Messages" {
352 auto = no
353 special_use = \Sent
354 }
355 mailbox "Envoyés" {
356 auto = no
357 special_use = \Sent
358 }
359 mailbox "Trash" {
360 auto = no
361 special_use = \Trash
362 #autoexpunge = 30d
363 }
364 mailbox "Corbeille" {
365 auto = no
366 special_use = \Trash
367 }
368 }
369 namespace Virtual {
370 mailbox All {
371 auto = no
372 comment = All messages from all mailboxes
373 special_use = \All
374 }
375 mailbox Recents {
376 auto = no
377 comment = All messages from all mailboxes arrived in the past 48h
378 }
379 }
380 }
381 plugin {
382 #sieve_default = file:${stateDir}/mail/%u/default.sieve
383 #sieve_default_name = default
384 sieve_plugins = sieve_imapsieve sieve_extprograms
385 sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.environment
386 #sieve_extensions = +editheader
387 sieve = file:~/sieve.d;active=~/sieve
388 sieve_pipe_bin_dir = ${sieve_pipe_bin_dir}/bin
389 sieve_max_script_size = 1M
390 sieve_quota_max_scripts = 0
391 sieve_quota_max_storage = 10M
392 #sieve_spamtest_max_value = 10
393 #sieve_spamtest_status_header = X-Spam-Score
394 #sieve_spamtest_status_type = strlen
395 sieve_user_log = /var/log/dovecot/%d/sieve.%n.log
396 # Enables support for user Sieve scripts in IMAP
397 #imapsieve_url = sieve://mail.${networking.domain}:4190
398
399 # When a flag changes, spam or ham according to the \Junk or \NonJunk flags
400 imapsieve_mailbox1_name = *
401 imapsieve_mailbox1_causes = FLAG
402 imapsieve_mailbox1_before = file:${stateDir}/sieve/global/spam-or-ham.sieve
403
404 # From elsewhere to Junk folder
405 imapsieve_mailbox2_name = Pourriel
406 imapsieve_mailbox2_causes = COPY APPEND
407 imapsieve_mailbox2_before = file:${stateDir}/sieve/global/report-spam.sieve
408
409 # From Junk folder to elsewhere
410 imapsieve_mailbox3_name = *
411 imapsieve_mailbox3_from = Pourriel
412 imapsieve_mailbox3_causes = COPY
413 imapsieve_mailbox3_before = file:${stateDir}/sieve/global/report-ham.sieve
414 }
415 protocol sieve {
416 # Maximum number of ManageSieve connections allowed for a user from each IP address.
417 # NOTE: The username is compared case-sensitively.
418 mail_max_userip_connections = 10
419
420 # To fool ManageSieve clients that are focused on CMU's timesieved you can specify
421 # the IMPLEMENTATION capability that the dovecot reports to clients.
422 # For example: 'Cyrus timsieved v2.2.13'
423 managesieve_implementation_string = Dovecot Pigeonhole
424
425 # The maximum number of compile errors that are returned to the client upon script
426 # upload or script verification.
427 managesieve_max_compile_errors = 5
428
429 #mail_max_userip_connections = 10
430 #managesieve_implementation_string = Dovecot Pigeonhole
431 managesieve_max_compile_errors = 5
432 #managesieve_max_line_length = 65536
433 #managesieve_notify_capability = mailto
434 #managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave
435 }
436 service managesieve-login {
437 inet_listener sieve {
438 port = 4190
439 #ssl = yes
440 }
441
442 # Number of connections to handle before starting a new process. Typically
443 # the only useful values are 0 (unlimited) or 1. 1 is more secure, but 0
444 # is faster. <doc/wiki/LoginProcess.txt>
445 service_count = 1
446
447 # Number of processes to always keep waiting for more connections.
448 process_min_avail = 0
449
450 # If you set service_count=0, you probably need to grow this.
451 #vsz_limit = 64M
452 }
453
454 service quota-warning {
455 executable = script ${
456 pkgs.writeScript "quota-warning" ''
457 #!/bin/sh -eu
458 PERCENT=$1
459 USER=$2
460 cat << EOF | ${pkgs.dovecot}/libexec/dovecot/dovecot-lda -d $USER -o
461 "plugin/quota=maildir:User quota:noenforcing"
462 From: postmaster@${networking.domain}
463 Subject: [WARNING] your mailbox is now $PERCENT% full.
464
465 Please remove some mails to make room for new ones.
466 EOF
467 ''
468 }
469 # use some unprivileged user for executing the quota warnings
470 user = ${dovecot2.user}
471 unix_listener quota-warning {
472 }
473 }
474
475 protocol pop3 {
476 mail_plugins = $mail_plugins virtual
477 #mail_max_userip_connections = 10
478 # Virtual namespace for the virtual INBOX.
479 # Use a global directory for dovecot-virtual files.
480 #namespace Inbox {
481 # hidden = yes
482 # list = no
483 # location = virtual:''${dovecot-virtual-pop3}/pop3:INDEX=${stateDir}/index/%d/%n/virtual/pop3:LAYOUT=fs
484 # prefix = pop3+
485 #}
486 pop3_client_workarounds =
487 pop3_fast_size_lookups = yes
488 pop3_lock_session = yes
489 pop3_no_flag_updates = yes
490 # Use GUIDs to avoid accidental POP3 UIDL changes instead of IMAP UIDs.
491 pop3_uidl_format = %g
492 }
493 service pop3 {
494 process_limit = 1024
495 }
496 service pop3-login {
497 inet_listener pop3s {
498 port = 995
499 ssl = yes
500 }
501 }
502 '';
503 #${lib.concatMapStringsSep "\n"
504 # (dom: ''
505 # local_name mail.${dom} {
506 # #ssl_ca = <''${caPath}
507 # ssl_cert = <${x509.cert dom}
508 # ssl_key = <${x509.key dom}
509 # }
510 # '')
511 # dovecot2.domains
512 #}
513 };
514 #services.postfix.mapFiles."transport-dovecot" =
515 # toFile "transport-dovecot"
516 # (unlines
517 # (lib.mapAttrsToList
518 # (dom: {...}: "${transportSubDomain}.${dom} lmtp:unix:private/dovecot-lmtp")
519 # dovecot2.domains));
520 }